qakbot | 62653335118bb647653455b6aba600123b00a26e2b1fb74ad422b66abba60cfe

General

Target

wayNewBy.dll
Size

537KB
MD5

9a2bb67af0a90c70f19289c1bde3ec0f
SHA1

ab755f5be63bc573b4405bcc76803f03c14d8d9a
SHA256

62653335118bb647653455b6aba600123b00a26e2b1fb74ad422b66abba60cfe
SHA512

cc03ffb662ca094b12449321410dc567317446e27c34bf52ca0ac1c5937f98a68abf006b9656eaae7f60825d791c19b01bbf06f0c116cd54a0cc97d74b3a58ff

Score

10^/10

qakbot obama198 1656660122 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama198

Campaign

1656660122

C2

86.200.151.188:2222

41.228.22.180:443

47.23.89.60:993

129.208.0.52:995

1.161.72.70:995

39.53.124.57:995

189.78.107.163:32101

24.43.99.75:443

197.89.17.87:443

111.125.245.116:995

80.11.74.81:2222

78.180.100.59:443

86.97.209.157:2222

24.178.196.158:2222

120.150.218.241:995

100.38.242.113:995

89.101.97.139:443

93.48.80.198:995

74.14.5.179:2222

40.134.246.185:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1076 regsvr32.exe

pid	process
1076	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3276 schtasks.exe

pid	process
3276	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozerzcxqjufme\cea05205 = 8e13125d341827adbedd6463086bc9fb6e8f1f470c8c0350f92cd2a653d3c637b2a016efbc11fd39d2496e32a9dc238e2f7c521a42063c8fa84839f91b7ba5c025af74025019e242afbf65d13dff08b36c7634111def1d5c179a1017cb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozerzcxqjufme\4383e52e = 8f4af057d15f7bb2ab614b5fe48cb60cafbc9755ff9b8a46f5bddbaba626174638f55f9eb8d9e9423737ab3d86	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozerzcxqjufme\745d151c = e1be80730d2451f9eb695bd3f6d40143352505f6	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozerzcxqjufme\761c3560 = 20fa048814b63d7e0d6a25711568c57c4a3464805434a3261294881581ac999520110baafa56acf0c901d00212248fa6ab07069accbd2de7e9a5b8680c6ee46c89e7f56bad66ad29c594fff237d52f1bef04cbe4293e907df37e4fd91bc6b098c537101ff6f7005e10ba612605524cacd2feb75a0ba3aa73088e6be7d32b8a28bb62f8701af8f6137742c2	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozerzcxqjufme\4383e52e = 8f4ae757d15f485b29fa48d95b422d4ec6a64dc46f6e7479	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozerzcxqjufme\9555a96 = a05229cd78a1de0cca4ad95c91fe01b4b4315b84408825ba1aa8519a02aa7e3d932b3ffacf63e64822f274d872b1737d929ed5ed691335eac7f95b382c0972de1c72a1e81463a67399e9e6bb6c320b24a883ab1e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozerzcxqjufme	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozerzcxqjufme\b1e93df3 = a70fe009856a450abb7ddac3147ac0d35fd65b325d6e52ba696858462e9b4d0449f79c41d4f355b8654dc214796fb1f9ef5a400b3be390a78e71666084bc647558092203a06ef2c9bba87029	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozerzcxqjufme\3cca8ad8 = e1e39d8ea8c881de735ac21c62ee0e63938fcd54066c12e33cf01179e9309624003f90f09a8a35e158bb7c7ff9cfe7e4875c8790e6ff1683575275	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozerzcxqjufme\cce17279 = 199a8075ca06d88bc77032a4acd71a153ab4b7f883832df2f19cf9945f685844adfe9e81168c8b2df29bd4533d5edfc871ac262b9a18565bd0d208478f1f599069bb5b5f658d1a336ac8452d9375e8d758	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
2080	regsvr32.exe
2080	regsvr32.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe
4908	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2080 regsvr32.exe
1076 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4124 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4124	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 3472 wrote to memory of 2080	3472	regsvr32.exe	regsvr32.exe
PID 3472 wrote to memory of 2080	3472	regsvr32.exe	regsvr32.exe
PID 3472 wrote to memory of 2080	3472	regsvr32.exe	regsvr32.exe
PID 2080 wrote to memory of 4908	2080	regsvr32.exe	explorer.exe
PID 2080 wrote to memory of 4908	2080	regsvr32.exe	explorer.exe
PID 2080 wrote to memory of 4908	2080	regsvr32.exe	explorer.exe
PID 2080 wrote to memory of 4908	2080	regsvr32.exe	explorer.exe
PID 2080 wrote to memory of 4908	2080	regsvr32.exe	explorer.exe
PID 4908 wrote to memory of 3276	4908	explorer.exe	schtasks.exe
PID 4908 wrote to memory of 3276	4908	explorer.exe	schtasks.exe
PID 4908 wrote to memory of 3276	4908	explorer.exe	schtasks.exe
PID 4124 wrote to memory of 2108	4124	powershell.exe	regsvr32.exe
PID 4124 wrote to memory of 2108	4124	powershell.exe	regsvr32.exe
PID 2108 wrote to memory of 1076	2108	regsvr32.exe	regsvr32.exe
PID 2108 wrote to memory of 1076	2108	regsvr32.exe	regsvr32.exe
PID 2108 wrote to memory of 1076	2108	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 3440	1076	regsvr32.exe	explorer.exe
PID 1076 wrote to memory of 3440	1076	regsvr32.exe	explorer.exe
PID 1076 wrote to memory of 3440	1076	regsvr32.exe	explorer.exe
PID 1076 wrote to memory of 3440	1076	regsvr32.exe	explorer.exe
PID 1076 wrote to memory of 3440	1076	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\wayNewBy.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3472

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\wayNewBy.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 14:31 /tn wkdmuhbvx /ET 14:42 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAdwBhAHkATgBlAHcAQgB5AC4AZABsAGwAIgA=" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:3276

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAdwBhAHkATgBlAHcAQgB5AC4AZABsAGwAIgA=
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\wayNewBy.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\wayNewBy.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:3440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wayNewBy.dll
Filesize
537KB

MD5
9a2bb67af0a90c70f19289c1bde3ec0f

SHA1
ab755f5be63bc573b4405bcc76803f03c14d8d9a

SHA256
62653335118bb647653455b6aba600123b00a26e2b1fb74ad422b66abba60cfe

SHA512
cc03ffb662ca094b12449321410dc567317446e27c34bf52ca0ac1c5937f98a68abf006b9656eaae7f60825d791c19b01bbf06f0c116cd54a0cc97d74b3a58ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\wayNewBy.dll
Filesize
537KB

MD5
9a2bb67af0a90c70f19289c1bde3ec0f

SHA1
ab755f5be63bc573b4405bcc76803f03c14d8d9a

SHA256
62653335118bb647653455b6aba600123b00a26e2b1fb74ad422b66abba60cfe

SHA512
cc03ffb662ca094b12449321410dc567317446e27c34bf52ca0ac1c5937f98a68abf006b9656eaae7f60825d791c19b01bbf06f0c116cd54a0cc97d74b3a58ff

Download Submit
memory/1076-145-0x0000000000E60000-0x0000000000E82000-memory.dmp

Filesize
136KB

Download
memory/1076-143-0x0000000000E60000-0x0000000000E82000-memory.dmp

Filesize
136KB

Download
memory/1076-140-0x0000000000000000-mapping.dmp

Download
memory/2080-131-0x0000000000C90000-0x0000000000CB2000-memory.dmp

Filesize
136KB

Download
memory/2080-133-0x0000000000C90000-0x0000000000CB2000-memory.dmp

Filesize
136KB

Download
memory/2080-130-0x0000000000000000-mapping.dmp

Download
memory/2108-138-0x0000000000000000-mapping.dmp

Download
memory/3276-134-0x0000000000000000-mapping.dmp

Download
memory/3440-144-0x0000000000000000-mapping.dmp

Download
memory/3440-146-0x0000000001060000-0x0000000001082000-memory.dmp

Filesize
136KB

Download
memory/3440-147-0x0000000001060000-0x0000000001082000-memory.dmp

Filesize
136KB

Download
memory/4124-137-0x000002CBED090000-0x000002CBED0B2000-memory.dmp

Filesize
136KB

Download
memory/4124-142-0x00007FFDCF750000-0x00007FFDD0211000-memory.dmp

Filesize
10.8MB

Download
memory/4908-136-0x0000000001030000-0x0000000001052000-memory.dmp

Filesize
136KB

Download
memory/4908-135-0x0000000001030000-0x0000000001052000-memory.dmp

Filesize
136KB

Download
memory/4908-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads